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Introduction 
Background 


On  January  8,  1993  Charles  A.  Bowsher,  Comptroller  General  of  the 
United  States,  testified  before  the  Committee  on  Governmental 
Affairs  of  the  United  States  Senate.  He  discussed  the  high-risk 
series  of  reports  issued  by  the  General  Accounting  Office  CGAO). 
This  series  of  reports  focused  on  the  Federal  Government's  efforts  to 
identify  and  correct  problems  in  17  areas  that  the  GAO  identified  as 
especially  vulnerable  to  waste,  fraud,  abuse,  and  mismanagement. 
When  the  GAO  started  its  high-risk  program  in  November  1989, 
they  reported  that  it  was  evident  that  "the  government  did  not  have 
the  internal  control  and  accounting  systems  necessary  to  effectively 
operate  many  of  its  programs  and  safeguard  its  assets." 

In  November  1990  Congress  enacted  the  "Chief  Financial  Officers 
(CFO)  Act  of  1990." 

Three  findings  listed  in  the  Act  (as  amended)  are  as  follows: 

"Billions  of  dollars  are  lost  each  year  through  fraud,  waste,  abuse,  and 
mismanagement  among  the  hundreds  of  programs  in  the  Federal 
Government." 

"These  losses  could  be  significantly  decreased  by  improved 
management,  including  improved  central  coordination  of  internal 
controls  and  financial  accounting." 

"The  Federal  Government  is  in  great  need  of  fundamental  reform  in 
financial  management  requirements  and  practices  as  financial 
management  systems  are  obsolete  and  inefficient,  and  do  not  provide 
complete,  consistent,  reliable,  and  timely  information." 

One  purpose  for  the  Act  listed  in  the  document  is...  "Provide  for 
improvement,  in  each  agency  of  the  Federal  Government,  of  systems 
of  accounting,  financial  management,  and  internal  controls  to  assure 
the  issuance  of  reliable  financial  information  and  to  deter  fraud, 
waste,  and  abuse  of  Government  resources." 
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The  Act  establishes  the  following: 

a  Deputy  Director  for  Management  within  0MB  ~  shall  be  the  chief 
official  responsible  for  financial  management  in  the  United  States 
Government; 

an  Office  of  Federal  Financial  Management  in  0MB; 

nothing  in  the  Act  shall  be  construed  to  interfere  with  the  exercise 
of  the  functions,  duties,  and  responsibilities  of  the  Department  of  the 
Treasury,  as  in  effect  immediately  before  the  enactment  of  this  Act; 

agency  Chief  Financial  Officers; 

need  for  OMB  to  submit  a  government  wide  5 -year  financial 
management  plan; 

need  for  Financial  Statements  by  agencies  submitted  to  OMB;  and 

need  for  Financial  Statements  to  be  audited  in  accordance  with 
applicable  generally  accepted  government  auditing  standards. 

In  1990  the  Federal  Accounting  Standards  Advisory  Board  (FASAB) 
was  created.  The  mission  of  the  FASAB  is  to  recommend 
accounting  standards  for  the  federal  government.  The  board  must 
consider  the  financial  and  budgetary  information  needs  of 
congressional  oversight  groups,  executive  agencies,  and  the  needs  of 
other  users  of  Federal  financial  information. 

In  April  1994  the  "Core  Financial  System  Requirements"  document, 
from  the  Joint  Financial  Management  Improvement  Program,  was 
updated  to  reflect  the  passage  of  the  Chief  Financial  Officers  Act  of 
1990;  the  creation  of  the  Federal  Accounting  Standards  Advisory 
Board;  the  experiences  of  the  departments  and  agencies  in  using  the 
original  document;  and  the  views  of  the  CFO  Council's  Financial 
Systems  Committee,  the  President's  Council  on  Integrity  and 
Efficiency,  and  others  interested  in  improving  financial  systems  in 
the  federal  government.  The  "Core  Financial  System  Requirements" 
document  establishes  standard  requirements  for  the  backbone 
applications  of  an  agency's  integrated  financial  management  system. 


Another  current  initiative  of  tiie  Treasury  Department,  ihc  I  rcasury 
Financial  Management  Service  (FMS)  consists  of  the  following 
components: 

■  The  U.  S.  Standard  General  Ledger 

■  The  Federal  Agencies  Centralized  Trial  Balance  System 

■  Credit  Reform 

In  congressional  testimony  Treasury's  Financial  Management  Service 
said...  "With  the  increasing  implementation  of  the  U.  S.  Standard 
General  Ledger  (SGL)  in  the  agencies,  a  much  improved  system 
becomes  possible.  'Standard'  is  the  key  word.  With  the  SGL, 
agencies  across  government  identify  certain  accounts  in  the  same 
way.  Because  of  this  standardization,  it  is  possible  to  retrieve  the 
actual  account  balances  directly  out  of  the  agencies'  accounting 
systems,  thus  eliminating  the  need  for  manually  compiled  reports. 
Because  of  this  standardization,  agencies  are  able  to  write  computer 
programs  which  more  fully  automate  the  transmission  of  financial 
data  to  FMS." 

About  this  Report      This  report  focuses  on  one  of  the  two  major  aspects  discussed 

above,  the  need  for  more  dependable  accounting  and  financial 
systems.  The  need  for  more  "Standard"  accounting  systems  across 
government  will  be  addressed  in  future  work  on  "Open  Accounting 
Systems."  This  report  recommends  a  service  for  use  by  management 
in  performing  self  audits  of  financial  systems.  Tools  used  in  the 
past  by  Electronic  Data  Processing  (EDP)  auditors  to  audit 
accounting  systems  are  examined,  and  the  similarities  between  these 
tools  and  the  service  recommended  in  this  report  can  be  observed. 
The  use  of  this  service  is  then  described  as  it  would  be  used  within 
the  accounting  system.  How  the  service  can  provide  more  internal 
control  and  financial  information  usually  obtained  from  analysis 
performed  by  financial  consultants  is  explained. 
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Monitoring 
Accounting 
Systems  in  the 
Past 


Historically  "monitoring"  of  accounting  systems  has  been  in  the 
form  of  audits  conducted  by  internal  auditors  such  as  those  from  the 
Office  of  the  Inspector  General,  or  from  outside  auditors  such  as 
those  from  the  General  Accounting  Office.  Generalized  Audit 
Software,  and  the  Integrated  Test  Facility  are  primary  tools  used  in 
performing  audits  on  computerized  accounting  systems.  This 
computer  software  typically  can  be  installed  on  the  system  under 
audit,  and  allows  the  auditor  to  extract  and  analyze  data  from  the 
financial  records  within  that  system.  Some  of  the  functions  in 
generalized  audit  software  allow  auditors  to  perform  the  following: 

data  file  analysis,  inquiry,  and  extraction; 

statistical  sampling,  file  summarization,  footing  and  recomputation; 

comparing,  joining  and  merging  files;  and 

aging  Accounts  Receivable,  gap  and  duplicate  record  detection. 

The  Integrated  Test  Facility  is  used  for  the  test  of: 

edit  checking  and  verification  criteria; 

database  updates  and  security  features  such  as  transaction  rollbacks 
computer  generated  transactions;  and  output. 

This  software  has  become  more  powerful  and  easier  to  use  over  the 
past  few  years,  and  now  crosses  all  computing  platforms  from 
mainframe  to  minicomputers  to  microcomputers. 
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Need  for 
Change 


It  can  be  easily  determined  that  the  methods  of  the  past  are  not 
totally  adequate.  The  audit  function  has  always  been,  and  will 
remain,  an  important  function.  It  has  always  been  necessary  for 
independent  verification  and  certification  of  financial  records  and 
this  will  not  change  in  the  future.  However,  it  is  often  not  possible 
to  allow  financial  systems  to  go  unaudited  for  any  given  length  of 
time  and  then  expect  to  be  able  to  perform  an  audit  to  determine  the 
areas  and  extent  of  problems.  Even  if  this  were  possible,  using  only 
this  kind  of  reactive  auditing  may  not  be  efficient.  The  ability  to 
constantly  monitor  (or  audit)  the  system  is  needed  to  establish  good 
financial  integrity  with  our  systems  today.  With  computer 
technology  as  it  is  today,  this  method  is  practical. 
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Self  Monitoring 
Allows 

Management  to 
be  Proactive 


Management  should  not  need  auditors  to  tell  them  where  problems 
exist.  Management  should  have  the  tools  and  ability  to  find  and 
correct  problems  as  they  occur.  New  accounting  systems  can 
provide  ways  to  prevent  errors  from  occurring.  One  method  is  to 
have  data  verification  and  edit-checking  occur  as  the  data  are 
entered.  Some  well  know  edit-checks  are: 


■  mandatory  fields  -  insures  that  vital  information  is  entered  in  the 
record; 

■  range  -  checks  to  see  that  data  input  to  a  certain  field  fits  within  pre- 
defined limits; 

■  list  -  limits  input  to  a  list  of  pre-defined  literals;  and 

■  unique  -  prevents  the  entering  of  two  records  with  the  same 
information  in  the  key  field. 

In  other  words,  reasonable  edit  checks  and  limits  are  established  as 
the  system  is  implemented.  Data  are  compared  to  these  checks  and 
limits  as  they  are  entered.  If  the  data  fail  the  tests,  the  user  must 
take  the  appropriate  action  to  correct  the  problem.  These  tests 
greatly  improve  the  quality  of  information  in  a  financial  information 
system.  Edit-checking  and  data  verification  as  described  above  are 
important  and  are  used  as  data  are  entered  into  the  system.  They 
operate  as  a  mechanism  to  decide  if  the  data  entered  should  be 
allowed  into  the  system.  If  the  data  are  not  acceptable,  they  are 
rejected  and  need  to  be  entered  again.  This  mechanism  should  be 
considered  to  be  the  first  level  of  self  monitoring  in  a  good  financial 
system.  Documentation  should  be  available  in  a  "Self  Monitoring" 
section  of  the  manuals  and  should  describe  in  detail  the  tests  that  are 
performed  on  data  being  entered  into  the  system.  These  edit-checks 
and  their  documentation  should  be  a  part  of  the  Self  Monitoring 
Service.  This  however  is  only  the  first  part  of  that  service.  Next 
we  must  verify  data  involved  in  multiple  transactions  such  as 
incurring  and  paying  a  liability.  Also  we  must  verify  transactions 
that  are  within  an  acceptable  range  but  which  still  should  cause 
management  to  take  a  second  look  after  they  are  in  the  system.  One 
example  is  the  need  to  review  valid  but  high  dollar  transactions. 
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These  capabilities  should  be  included  in  the  Sell  Monitoring  Service 
as  a  set  of  reports  generated  by  queries  to  the  data  in  the  system. 
These  reports  should  give  the  manager  some  of  the  functionality  that 
has  been  used  by  auditors  to  analyze  the  data  in  the  system.  The 
service  should  also  include  those  tools  auditors  use  such  as 
Generalized  Audit  Software  and  the  Integrated  Test  Facility.  These 
kinds  of  capabilities  could  and  should  be  included  in  accounting 
systems  allowing  management  to  perform  the  functions  and  tests 
described  previously  on  page  4.  Management  could  then  more 
easily  perform  financial  analysis  on  the  data  from  their  accounting 
systems  and  they  would  also  have  the  ability  to  find  discrepancies  in 
accounts  and  transactions  as  they  occur. 

The  Self  Monitoring  Service  should  include  expert  system 
functionality  that  allows  for  an  information  store  of  applicable  rules, 
regulations,  accounting  policy  and  law  to  be  compared  to 
transactions.  This  expert  system  functionality  could  be  provided 
with  or  without  the  use  of  an  actual  expert  system.  The  store  of 
rules,  regulations,  policy,  and  law  will  be  used  for  both  edit-checks 
and  reports  to  management  on  discrepancies  found  in  the  records. 
The  store  could  also  contain  information  regarding  managements 
goals.  The  Self  Monitoring  Service  could  then  test  and  report  to 
management  the  level  of  success  with  which  these  goals  are  being 
met.  The  figure  below  is  a  flowchart  of  how  systems  are  currently 
audited/monitored  and  how  they  would  be  audited/monitored  with 
the  Self  Monitoring  Service  in  place. 


The  unshaded  blocks 
represent  the  use  of 
Generalized  Audit 
Software  with  an 
accounting  system. 
The  shaded  areas 
show  the  Self 
Monitoring  Service 
Added. 
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Considerations 
for 

Implementation 
of  the  Self 
Monitoring 
Service 


The  Self  Monitoring  Service  will  contain  a  set  of  edit-checking  and 
data  verification  functions  and  a  set  of  reports  based  on  queries 
made  of  the  financial  records.  If  the  financial  system  is  built  on  top 
of  a  relational  database,  designing  these  edit-checks  and  reports  from 
a  computer  technology  standpoint  is  simple.  In  any  case  these 
capabilities  are  technically  possible.  A  more  vexing  question  is 
where  and  how  to  implement  the  edit-checks  and  who  should 
develop  the  reports  for  the  Self  Monitoring  Service.  The  answer  to 
this  question  will  probably  be  different  in  each  situation.  In  an 
organization  that  is  made  up  of  very  uniform  divisions,  the 
implementation  can  probably  be  done  by  the  developer  of  the 
financial  system  or  at  a  central  point  in  the  organization.  In  a  very 
diverse  organization,  implementation  will  probably  be  needed  for 
each  division.  In  most  cases  there  will  likely  be  a  combination  of 
these  two  methods.  There  are  some  areas  such  as  travel  where 
similarities  exist  in  how  organizations  do  things.  This  would  allow 
a  large  portion  of  the  Self  Monitoring  Service  to  be  developed  for 
an  entire  organization.  Some  minor  additions  or  changes  may  be 
needed  in  some  divisions  or  areas  within  the  organization.  These 
changes  will  most  likely  be  more  effective  if  they  are  developed 
with  the  help  of  the  division  that  will  use  them.  In  all  cases  the 
help  of  an  audit  organization  is  essential.  In  the  case  of  the  federal 
government  the  Office  of  the  Inspector  General  is  probably  a  good 
audit  organization  to  have  involved.  This  involvement  will  assure 
that  the  set  of  tools  in  the  Self  Monitoring  Service  is  complete  and 
relevant. 


The  Self  Monitoring  Service  might  include  the  following  set  of  edit 
checks  or  queries  to  the  financial  records: 

■  Prevent  duplicate  or  overpayment  for  goods  or  services 

■  Prevent  duplicate  payments  or  over  payments  for  travel 

■  Prevent  a  payment  from  being  made  to  a  male  patient  for  prenatal 
care 

'km     Prevent  a  transaction  for  a  dollar  amount  that  is  higher  than  an 
authorized  amount 

■  Report  payments  that  are  not  made  in  a  timely  manner 

■  Report  payments  that  are  legal  but  are  for  a  high  dollar  value  (These 
may  be  correct,  but  management  might  want  to  review  them) 
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Assure  that  benefit  payments  are  not  paid  for  a  longer  period  of  time 
than  legal 

Identify  all  employees  who  received  an  advance  of  $1,000  or  more 

Identify  all  employees  with  travel  claims  that  have  been  outstanding 
for  longer  than  a  given  period 

Prevent  the  payment  of  transportation  cost  that  exceeds  the 
transportation  cost  authorized 

Identify  those  instances  in  which  transportation  cost  claimed  exceeds 
the  transportation  cost  authorized 

Identify  those  instances  where  travel  was  completed,  an  advance  was 
drawn,  and  the  agency  reimbursed  the  individual  between  specific 
amounts  such  as  $200  and  $500 

Identify  all  employees  who  took  longer  than  10  days  to  file  their 
claims  after  completing  their  travel 

Verify  the  interest  rate  for  a  loan  during  a  designated  period 

Verify  the  discount  rate  for  a  specific  quantity  ordered. 

Travel  is  an  area  where  most  organizations  and  parts  of 
organizations  tend  to  have  very  similar  operating  methods.  Still  it  is 
not  clear  that  the  dollar  ranges  in  the  above  example  would  apply  to 
all  parts  of  an  organization.  For  instance,  some  parts  of  the 
organization  might  have  reason  to  travel  internationally.  In  this 
case,  the  dollar  amounts  would  be  expected  to  be  higher  than  a  part 
of  the  organization  that  never  has  the  need  for  international  travel. 
This  is  an  example  of  where  changes  would  be  needed  at  various 
parts  of  the  organization. 


Conclusions  There  is  concern  from  many  levels  of  government  regarding  the 

need  for  more  dependable  accounting  and  financial  systems  in  use 
within  the  Federal  Government  today.  Clearly,  current  systems  and 
methods  of  monitoring  these  systems  are  not  working  well.  It  is 
important  to  build  into  financial  systems  as  many  methods  as 
possible  to  monitor  the  transactions  of  the  systems;  to  have  methods 
that  determine  the  validity  of  data  before  they  are  entered  into  the 
system;  and  for  management  to  be  able  to  take  a  second  look  at 
'        particularly  sensitive  data  after  they  are  in  the  system.  It  is  also 
important  to  build  other  audit  tools  such  as  Generalized  Audit 
Software  and  the  Integrated  Test  Facility  into  today's  financial 
systems.  Finally,  it  is  important  to  include  expert  system 
functionality  such  as  providing  management  reports  that  indicate 
how  the  data  in  the  system  compare  with  rules,  regulations,  laws  and 
goals  of  the  organization.  Today's  computer  technology  makes  this 
possible.  Implementors  of  new  accounting  systems  should  include  a 
set  of  tools  that  prevents  obviously  incorrect  data  from  being  entered 
into  the  system,  and  allows  management  to  review  data  that  are 
determined  to  be  sensitive  to  the  organization.  These  tools  should 
be  well  documented  and  presented  in  a  central  place  within  the 
system.  This  group  of  tools  can  be  thought  of  and  described  to 
audit  organizations  as  a  Self  Monitoring  Service.  Audit 
organizations  base  the  decision  of  how  complete  an  audit  is  needed 
for  a  system  in  part  on  the  internal  control  included  in  the  system. 
The  Self  Monitoring  Service,  if  well  thought  out  and  well 
documented  in  conjunction  with  the  audit  organization,  should  serve 
to  lower  the  audit  work  and  the  audit  cost  incurred  by  the 
organization  in  producing  audited  financial  statements  for  the 
organization. 
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States  -  "Government  Management  -  Report  on  17  High- 
Risk  Areas,"  Testimony  Before  the  Committee  on 
Governmental  Affairs,  United  States  Senate,  January  8, 
1993. 

2.  One  Hundred  First  Congress  of  the  United  States  of  America 
-  "Chief  Financial  Officers  Act  of  1990,"  January  23,  1990 
(amended  1994). 

3.  Joint  Financial  Management  Improvement  Program  -  "Core 
Financial  System  Requirements,"  January  1988  and  Revised 
April  1994. 

4.  John  W.  Lainhart,  IV  and  Barry  R.  Snyder  -  "A 
Simultaneous-Parallel  Approach  To  Testing  Computerized 
Systems,"    GAO  Review,  Summer  1977. 

5.  United  States  General  Accounting  Office  -  "Assessing  the 
Reliability  of  Computer-Processed  Data,"  GAO/OP-8.1 .3, 
September  1990. 
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ANNOUNCEMENT  OF  NEW  PUBLICATIONS  ON 
COMPUTER  SYSTEMS  TECHNOLOGY 


Superintendent  of  Documents 
Government  Printing  Office 
Washington,  DC  20402 

Dear  Sir: 

Please  add  my  name  to  the  announcement  Hst  of  new  pubUcations  to  be  issued  in 
the  series:  National  Institute  of  Standards  and  Technology  Special  Publication  500-. 

Name  

Company  

Address  

City   State   Zip  Code  

(Notification  key  N-503) 

U.S.  Government  Printing  Office  -is  :1995  390-201 


Technical  Publications 


Periodical 


Journal  of  Research  of  the  National  Institute  of  Standards  and  Technology — Reports  NIST  research 
and  development  in  those  disciplines  of  the  physical  and  engineering  sciences  in  which  the  Institute  is 
active.  These  include  physics,  chemistry,  engineering,  mathematics,  and  computer  sciences.  Papers  cover  a 
broad  range  of  subjects,  with  major  emphasis  on  measurement  methodology  and  the  basic  technology 
underlying  standardization.  Also  included  from  time  to  time  are  survey  articles  on  topics  closely  related  to 
the  Institute's  technical  and  scientific  programs.  Issued  six  times  a  year. 

Nonperiodicals 


Monographs — Major  contributions  to  the  technical  literature  on  various  subjects  related  to  the 
Institute's  scientific  and  technical  activities. 

Handbooks — Recommended  codes  of  engineering  and  industrial  practice  (including  safety  codes)  devel- 
oped in  cooperation  with  interested  industries,  professional  organizations,  and  regulatory  bodies. 
Special  Publications — Include  proceedings  of  conferences  sponsored  by  NIST,  NIST  annual  reports,  and 
other  special  publications  appropriate  to  this  grouping  such  as  wall  charts,  pocket  cards,  and  bibliographies. 

National  Standard  Reference  Data  Series — Provides  quantitative  data  on  the  physical  and  chemical 
properties  of  materials,  compiled  from  the  world's  literature  and  critically  evaluated.  Developed  under  a 
worldwide  program  coordinated  by  NIST  under  the  authority  of  the  National  Standard  Data  Act  (Public 
Law  90-396).  NOTE:  The  Journal  of  Physical  and  Chemical  Reference  Data  (JPCRD)  is  published 
bimonthly  for  NIST  by  the  American  Chemical  Society  (ACS)  and  the  American  Institute  of  Physics  (AIP). 
Subscriptions,  reprints,  and  supplements  are  available  from  ACS,  1155  Sixteenth  St.,  NW,  Washington,  DC 
20056. 

Building  Science  Series — Disseminates  technical  information  developed  at  the  Institute  on  building 
materials,  components,  systems,  and  whole  structures.  The  series  presents  research  results,  test  methods,  and 
performance  criteria  related  to  the  structural  and  environmental  functions  and  the  durability  and  safety 
characteristics  of  building  elements  and  systems. 

Technical  Notes — Studies  or  reports  which  are  complete  in  themselves  but  restrictive  in  their  treatment  of 
a  subject.  Analogous  to  monographs  but  not  so  comprehensive  in  scope  or  definitive  in  treatment  of  the 
subject  area.  Often  serve  as  a  vehicle  for  final  reports  of  work  performed  at  NIST  under  the  sponsorship  of 
other  government  agencies. 

Voluntary  Product  Standards — Developed  under  procedures  published  by  the  Department  of  Commerce 
in  Part  10,  Title  15,  of  the  Code  of  Federal  Regulations.  The  standards  establish  nationally  recognized 
requirements  for  products,  and  provide  all  concerned  interests  with  a  basis  for  common  understanding  of 
the  characteristics  of  the  products.  NIST  administers  this  program  in  support  of  the  efforts  of  private-sector 
standardizing  organizations. 

Order  the  following  NIST  publications — FIPS  and  NISTIRs—from  the  National  Technical  Information 

Service,  Springfield,  VA  22161. 

Federal  Information  Processing  Standards  Publications  (FIPS  PUB) — Publications  in  this  series 
collectively  constitute  the  Federal  Information  Processing  Standards  Register.  The  Register  serves  as  the 
official  source  of  information  in  the  Federal  Government  regarding  standards  issued  by  NIST  pursuant  to 
the  Federal  Property  and  Administrative  Services  Act  of  1949  as  amended,  Public  Law  89-306  (79  Stat. 
1127),  and  as  implemented  by  Executive  Order  11717  (38  FR  12315,  dated  May  11,  1973)  and  Part  6  of 
Title  15  CFR  (Code  of  Federal  Regulations). 

NIST  Interagency  Reports  (NISTIR) — A  special  series  of  interim  or  final  reports  on  work  performed  by 
NIST  for  outside  sponsors  (both  government  and  nongovernment).  In  general,  initial  distribution  is  handled 
by  the  sponsor;  public  distribution  is  by  the  National  Technical  Information  Service,  Springfield,  VA  22161, 
in  paper  copy  or  microfiche  form. 


